Subject: Re: I-D ACTION:draft-ietf-pkix-pi-08.txt

From: Tom Gindin <[email-masked]>
Date: Thu, 3 Jun 2004 07:53:52 -0400

David:

        The first  tag (for Value) is not needed.  I would think that the 
second field should be called something like "assignerDomain" or 
"assignerNode".

                Tom Gindin

"David P. Kemp" <[email-masked]>
Sent by: [email-masked]
06/02/2004 03:22 PM

        To:     Anders Rundgren <[email-masked]>
        cc:     [email-masked]
        Subject:        Re: I-D ACTION:draft-ietf-pkix-pi-08.txt

Ahh, I had fancied that my ASN.1 did not suck, but you have
shattered that illusion.  It does need a [] or two:

PermanentIdentifier ::= SEQUENCE {
     identifierValue     [0] UTF8String  OPTIONAL,
     identifierAssigner  [1] UTF8String  OPTIONAL }

Anders Rundgren wrote:

> 
> A margin comment:  Although my ASN.1 surely sucks, shouldn't
> there be a [] or two to properly spice this up?
> 
> best
> Anders
>

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 03 Jun 2004 09:30:30 -0400

Tom,

As long as we're being technical, either the first or the second tag
is not needed - all that is required is to unambiguously distinguish
between one optional field and the other.  I don't agree with Peter
that two tags is massive overuse - there is no difference in the number
of octets with IMPLICIT TAGS, and the ASN.1 looks more uniform when
all optional fields are context-tagged.  Maybe Peter is a free spirit
who just doesn't like all his text lined up in straight columns :-).

I hope this thread will morph into a discussion of the wisdom of using
DNS name as the identifier for assigner, vs. using an OID, or a CHOICE
of DNS or OID.

I think that the IESG's objections to using a URI do not apply to
using a DNS name, because the URI always implies an online access
by the client to fetch some resource, while the DNS name implies
that the assigner has registered a name but does not require any
online access to a changeable value (A / MX / RR lookup) by the
client.

OID registration is more formal and is free; DNS registration
is a little more "internet friendly" but requires a fee if an
assigner does not already have an internet presence.  I don't
have a preference for one over the other.  I do oppose
a CHOICE because of the unnecessary complexity.  There should
be no situation where an assigner could not register either
an OID or a DNS name, so standardizing on either one is
preferable to requiring support for both.

I don't have any particular preference for a name for the second
field, although the emphasis should be on "Assigner" (the fact
that there is a registered business entity) rather than on the
syntax of the registered name (the fact that it is a DNS domain
or node).

Dave

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 04 Jun 2004 02:45:08 +1200

"David P. Kemp" <[email-masked]> writes:

>I don't agree with Peter that two tags is massive overuse - there is no
>difference in the number of octets with IMPLICIT TAGS, and the ASN.1 looks
>more uniform when all optional fields are context-tagged.  Maybe Peter is a
>free spirit who just doesn't like all his text lined up in straight columns
>:-).

Hiding type information via unnecessary tagging makes data checking/display
using ASN.1 tools extremely difficult.  There's nothing more painful than
having to debug/pick apart some implementation's broken PDUs where every field
is an implicit OCTET STRING.

Peter.